Chapter 7. Red Hat Developer Hub integration with Amazon Web Services (AWS)

Prerequisites

• You have a User Pool or you have created a new one. For more information about user pools, see Amazon Cognito user pools documentation.

  Note

  Ensure that you have noted the AWS region where the user pool is located and the user pool ID.

• You have created an App Client within your user pool for integrating the hosted UI. For more information, see Setting up the hosted UI with the Amazon Cognito console.

  When setting up the hosted UI using the Amazon Cognito console, ensure to make the following adjustments:

  1. In the Allowed callback URL(s) section, include the URL https://<rhdh_url>/api/auth/oidc/handler/frame. Ensure to replace <rhdh_url> with your Developer Hub application’s URL, such as, my.rhdh.example.com.
  2. Similarly, in the Allowed sign-out URL(s) section, add https://<rhdh_url>. Replace <rhdh_url> with your Developer Hub application’s URL, such as my.rhdh.example.com.
  3. Under OAuth 2.0 grant types, select Authorization code grant to return an authorization code.

  4. Under OpenID Connect scopes, ensure to select at least the following scopes:

     • OpenID
     • Profile
     • Email

  Helm deployment

  Procedure

  1. Edit or create your custom app-config-rhdh ConfigMap as follows:

     apiVersion: v1
     kind: ConfigMap
     metadata:
       name: app-config-rhdh
     data:
       "app-config-rhdh.yaml": |
         # --- Truncated ---
         app:
           title: Red Hat Developer Hub
     
         signInPage: oidc
         auth:
           environment: production
           session:
             secret: ${AUTH_SESSION_SECRET}
           providers:
             oidc:
               production:
                 clientId: ${AWS_COGNITO_APP_CLIENT_ID}
                 clientSecret: ${AWS_COGNITO_APP_CLIENT_SECRET}
                 metadataUrl: ${AWS_COGNITO_APP_METADATA_URL}
                 callbackUrl: ${AWS_COGNITO_APP_CALLBACK_URL}
                 scope: 'openid profile email'
                 prompt: auto

     Copy to Clipboard Toggle word wrap

  2. Edit or create your custom secrets-rhdh Secret using the following template:

     apiVersion: v1
     kind: Secret
     metadata:
       name: secrets-rhdh
     stringData:
       AUTH_SESSION_SECRET: "my super auth session secret - change me!!!"
       AWS_COGNITO_APP_CLIENT_ID: "my-aws-cognito-app-client-id"
       AWS_COGNITO_APP_CLIENT_SECRET: "my-aws-cognito-app-client-secret"
       AWS_COGNITO_APP_METADATA_URL: "https://cognito-idp.[region].amazonaws.com/[userPoolId]/.well-known/openid-configuration"
       AWS_COGNITO_APP_CALLBACK_URL: "https://[rhdh_dns]/api/auth/oidc/handler/frame"

     Copy to Clipboard Toggle word wrap

  3. Add references of both the ConfigMap and Secret resources in your values.yaml file:

     upstream:
       backstage:
         image:
           pullSecrets:
           - rhdh-pull-secret
         podSecurityContext:
           fsGroup: 2000
         extraAppConfig:
           - filename: app-config-rhdh.yaml
             configMapRef: app-config-rhdh
         extraEnvVarsSecrets:
           - secrets-rhdh

     Copy to Clipboard Toggle word wrap

  4. Upgrade the Helm deployment:

     helm upgrade rhdh \
       openshift-helm-charts/redhat-developer-hub \
       [--version 1.2.6] \
       --values /path/to/values.yaml

     Copy to Clipboard Toggle word wrap

  Operator-backed deployment

  1. Add the following code to your app-config-rhdh ConfigMap:

     apiVersion: v1
     kind: ConfigMap
     metadata:
       name: app-config-rhdh
     data:
       "app-config-rhdh.yaml": |
         # --- Truncated ---
     
         signInPage: oidc
         auth:
           # Production to disable guest user login
           environment: production
           # Providing an auth.session.secret is needed because the oidc provider requires session support.
           session:
             secret: ${AUTH_SESSION_SECRET}
           providers:
             oidc:
               production:
                 # See https://github.com/backstage/backstage/blob/master/plugins/auth-backend-module-oidc-provider/config.d.ts
                 clientId: ${AWS_COGNITO_APP_CLIENT_ID}
                 clientSecret: ${AWS_COGNITO_APP_CLIENT_SECRET}
                 metadataUrl: ${AWS_COGNITO_APP_METADATA_URL}
                 callbackUrl: ${AWS_COGNITO_APP_CALLBACK_URL}
                 # Minimal set of scopes needed. Feel free to add more if needed.
                 scope: 'openid profile email'
     
                 # Note that by default, this provider will use the 'none' prompt which assumes that your are already logged on in the IDP.
                 # You should set prompt to:
                 # - auto: will let the IDP decide if you need to log on or if you can skip login when you have an active SSO session
                 # - login: will force the IDP to always present a login form to the user
                 prompt: auto

     Copy to Clipboard Toggle word wrap

  2. Add the following code to your secrets-rhdh Secret:

     apiVersion: v1
     kind: Secret
     metadata:
       name: secrets-rhdh
     stringData:
       # --- Truncated ---
     
       # TODO: Change auth session secret.
       AUTH_SESSION_SECRET: "my super auth session secret - change me!!!"
     
       # TODO: user pool app client ID
       AWS_COGNITO_APP_CLIENT_ID: "my-aws-cognito-app-client-id"
     
       # TODO: user pool app client Secret
       AWS_COGNITO_APP_CLIENT_SECRET: "my-aws-cognito-app-client-secret"
     
       # TODO: Replace region and user pool ID
       AWS_COGNITO_APP_METADATA_URL: "https://cognito-idp.[region].amazonaws.com/[userPoolId]/.well-known/openid-configuration"
     
       # TODO: Replace <rhdh_dns>
       AWS_COGNITO_APP_CALLBACK_URL: "https://[rhdh_dns]/api/auth/oidc/handler/frame"

     Copy to Clipboard Toggle word wrap

  3. Ensure your Custom Resource contains references to both the app-config-rhdh ConfigMap and secrets-rhdh Secret:

     apiVersion: rhdh.redhat.com/v1alpha1
     kind: Backstage
     metadata:
      # TODO: this the name of your Developer Hub instance
       name: my-rhdh
     spec:
       application:
         imagePullSecrets:
         - "rhdh-pull-secret"
         route:
           enabled: false
         appConfig:
           configMaps:
             - name: "app-config-rhdh"
         extraEnvs:
           secrets:
             - name: "secrets-rhdh"

     Copy to Clipboard Toggle word wrap

  4. Optional: If you have an existing Developer Hub instance backed by the Custom Resource and you have not edited it, you can manually delete the Developer Hub deployment to recreate it using the operator. Run the following command to delete the Developer Hub deployment:

     kubectl delete deployment -l app.kubernetes.io/instance=<CR_NAME>

     Copy to Clipboard Toggle word wrap